http2: limit the size of the re-assembled cookie header#45476
Conversation
Signed-off-by: Yan Avlasov <[email protected]>
Signed-off-by: Yan Avlasov <[email protected]>
wbpcode
left a comment
There was a problem hiding this comment.
Thanks for this contribution. This should could make the migration more smoothly. Only one comment.
| runtime.has_value() ? runtime->snapshot().getInteger( | ||
| "envoy.reloadable_features.http2_max_cookies_size_in_kb", 0) * | ||
| 1024 | ||
| : 0), |
There was a problem hiding this comment.
Will this be removed in the future? Once envoy.reloadable_features.http2_include_cookies_in_limits been removed in the future?
There was a problem hiding this comment.
Yes, we will remove it in the future. This is a stop-gap for now to protect from exploit. However Envoy may need H/2 specific settings for header map given how cookies are trasmitted.
There was a problem hiding this comment.
Yes, we will remove it in the future. This is a stop-gap for now to protect from exploit. However Envoy may need H/2 specific settings for header map given how cookies are trasmitted.
Yeah. may be we could double or 1.5x the default limit for HTTP2
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for #45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
Backport for #45476 Signed-off-by: yanavlasov <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]> Co-authored-by: yanavlasov <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
HTTP/2 user agents split individual cookies into dedicated header entries to improve header map compression. The ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` value can be set to limit the size of the re-assembled cookie header. This value is 0 by default, which is treated as having no limit. This value can be used as a stop gap protection while safe header map count and size limits are determined for H/1 requests. Risk Level: low Testing: unit tests Docs Changes: no Release Notes: yes Platform Specific Features: no --------- Signed-off-by: Yan Avlasov <[email protected]> Signed-off-by: yanavlasov <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for #45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]>
HTTP/2 user agents split individual cookies into dedicated header entries to improve header map compression. The ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` value can be set to limit the size of the re-assembled cookie header. This value is 0 by default, which is treated as having no limit. This value can be used as a stop gap protection while safe header map count and size limits are determined for H/1 requests. Risk Level: low Testing: unit tests Docs Changes: no Release Notes: yes Platform Specific Features: no --------- Signed-off-by: Yan Avlasov <[email protected]> Signed-off-by: yanavlasov <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for #45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]>
HTTP/2 user agents split individual cookies into dedicated header entries to improve header map compression. The ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` value can be set to limit the size of the re-assembled cookie header. This value is 0 by default, which is treated as having no limit. This value can be used as a stop gap protection while safe header map count and size limits are determined for H/1 requests. Risk Level: low Testing: unit tests Docs Changes: no Release Notes: yes Platform Specific Features: no --------- Signed-off-by: Yan Avlasov <[email protected]> Signed-off-by: yanavlasov <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for #45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy/envoy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: Kateryna Nezdolii <[email protected]> Signed-off-by: dcillera <[email protected]>
…5476) HTTP/2 user agents split individual cookies into dedicated header entries to improve header map compression. The ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` value can be set to limit the size of the re-assembled cookie header. This value is 0 by default, which is treated as having no limit. This value can be used as a stop gap protection while safe header map count and size limits are determined for H/1 requests. Risk Level: low Testing: unit tests Docs Changes: no Release Notes: yes Platform Specific Features: no --------- Signed-off-by: Yan Avlasov <[email protected]>
Document the http2.cookies_total_bytes_too_large counter added for the HTTP/2 re-assembled cookie header size limit. Followup for envoyproxy#45476 <!-- !!!ATTENTION!!! If you are fixing **any** crash or **any** potential security issue, **do not open a pull request**. Instead, please [open a GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/new) (preferred). Alternatively, you may email [email protected]. Thank you in advance for helping to keep Envoy secure. !!!ATTENTION!!! For an explanation of how to fill out the fields, please see the relevant section in [PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md) !!!ATTENTION!!! Please check the [use of generative AI policy](https://github.com/envoyproxy/envoy/blob/main/CONTRIBUTING.md?plain=1#L41). You may use generative AI only if you fully understand the code. You need to disclose this usage in the PR description to ensure transparency. --> Commit Message: Additional Description: Risk Level: Testing: Docs Changes: Release Notes: Platform Specific Features: [Optional Runtime guard:] [Optional Fixes #Issue] [Optional Fixes commit #PR or SHA] [Optional Deprecated:] [Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):] Signed-off-by: Kateryna Nezdolii <[email protected]>
HTTP/2 user agents split individual cookies into dedicated header entries to improve header map compression. The
envoy.reloadable_features.http2_max_cookies_size_in_kbvalue can be set to limit the size of the re-assembled cookie header. This value is 0 by default, which is treated as having no limit.This value can be used as a stop gap protection while safe header map count and size limits are determined for H/1 requests.
Risk Level: low
Testing: unit tests
Docs Changes: no
Release Notes: yes
Platform Specific Features: no